DITEKSHEN_MALWARE_Win_Bitcoingrabber

rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
{
	meta:
		description = "Detects generic bitcoin stealer"
		author = "ditekSHen"
		id = "f73b58da-1db5-5767-ae0a-074648e30966"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5859-L5875"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s2 = "Bitcoin-Grabber" ascii
		$s3 = "Bitcoin_Grabber" ascii
		$s4 = "encrypt resources [compress]T" fullword ascii
		$s5 = "code control flow obfuscationT" fullword ascii
		$s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii
		$pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide
		$pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide
		$pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $pat* ) and 2 of ( $s* ) )
}